System for automatically recovering a computer memory using shadowed data and file directory structures

ABSTRACT

The Data Shadowing System comprises a memory module that is connected to the monitored computer system via an existing input/output port to store the shadowed data. The memory module includes a memory device for data storage as well as software, including a control software component that is automatically installed on the monitored computer system when the memory module is first connected to the monitored computer system, as well as associated module software for maintaining a record of the data stored on the memory device. The Data Shadowing System automatically stores the data on the memory module in a single format, while representing it in a data management database in two formats: disk sectors and files. The Data Shadowing System thereby efficiently tracks and stores the state of multiple file systems over time, while allowing for correct disk-level and file-level restoration to a point-in-time without storing redundant data.

This application is a utility filing which claims priority to U.S.Provisional Application No. 60/863,665, titled “Data Backup Systems AndMethods” and filed on 31 Oct. 2006. This application is also related tothe following U.S. Patent Applications filed on the same date as thepresent application: System For Automatically Shadowing Data And FileDirectory Structures That Are Recorded On A Computer Memory; System ForAutomatically Shadowing Data And File Directory Structures For APlurality Of Network Connected Computers Using A Network-Attached MemoryWith Single Instance Storage; and System For Automatically ShadowingEncrypted Data And File Directory Structures For A Plurality OfNetwork-Connected Computers Using A Network-Attached Memory With SingleInstance Storage.

FIELD OF THE INVENTION

This invention relates to systems that are used to provide data backupfor individual computer systems.

BACKGROUND OF THE INVENTION

It is a problem both to safeguard data that is stored on a computersystem and to restore all or portions of this data that are lost orcorrupted. Many computer systems have no protection systems in place,and the loss of data from these computer systems is irrevocable. Othercomputer systems make use of attached data backup systems to store acopy of the data that is stored in the computer memory and updatesthereto for eventual retrieval to restore data that is lost from orcorrupted in the computer system memory. However, the use of theseexisting data backup systems is laborious and can be confusing to thecasual user.

In information technology, backup refers to making copies of data sothat these additional copies may be used to restore the original after adata loss event. These additional copies are typically called “backups.”Backups are useful primarily for two purposes. The first is to restore acomputer to an operational state following a disaster (called “disasterrecovery”). The second is to restore one or more files after they havebeen accidentally deleted or corrupted. Backups are typically that lastline of defense against data loss and, consequently, the least granularand the least convenient to use.

Since a data backup system contains at least one copy of all data worthsaving, the data storage requirements are considerable, which datastorage requirements can be exacerbated by the method used to performthe data backup where change tracking is wasteful of memory. Organizingthis storage space and managing the backup process is a complicatedundertaking. A data repository model can be used to provide structure tothe data storage device for the management of the data that is backedup. In the modern era of computing, there are many different types ofdata storage devices that are useful for making backups. There are alsomany different ways in which these data backup devices can be arrangedto provide geographic redundancy, data security, and portability.

Before data is ever sent to its data backup storage location, it isselected, extracted, and manipulated. Many different techniques havebeen developed to optimize the backup procedure. These includeoptimizations for dealing with open files and live data sources as wellas compression, encryption, and de-duplication, among others. Manyorganizations and individuals require that they have some confidencethat the backup process is working as expected and work to definemeasurements and validation techniques to confirm the integrity of thebackup process. It is also important to recognize the limitations andhuman factors involved in any backup scheme.

Due to a considerable overlap in technology, backups and data backupsystems frequently are confused with archives and fault-tolerantsystems. Backups differ from archives in the sense that archives are theprimary copy of data and backups are a secondary copy of data. Databackup systems differ from fault-tolerant systems in the sense that databackup systems assume that a fault will cause a data loss event, andfault-tolerant systems assume a fault will not cause a data loss event.

Data Repository Models

Any backup strategy starts with the concept of a data repository. Thebackup data needs to be stored somehow and probably should be organizedto a degree. It can be as simple as a manual process which uses a sheetof paper with a list of all backup tapes and the dates they were writtenor a more sophisticated automated setup with a computerized index,catalog, or relational database. Different repository models havedifferent advantages. This is closely related to choosing a backuprotation scheme. The following paragraphs summarize the various existingbackup models presently in use.

Unstructured

An unstructured repository may simply be a writeable media consistingof, for example, a stack of floppy disks or CD-R media with minimalinformation about what data from the computer system was backed up ontothis writeable media and when the backup(s) occurred. This is theeasiest backup method to implement but probably the least likely toachieve a high level of recoverability due to the dearth of indexinginformation that is associated with the data that is backed up.

Full+Incremental

A Full+Incremental data backup model aims to make storing several copiesof the source data more feasible. At first, a full backup of all filesfrom the computer system is taken. After that full backup is completed,an incremental backup of only the files that have changed since theprevious full or incremental backup is taken. Restoring the wholecomputer system to a certain point in time requires locating not onlythe full backup taken previous to that certain point in time but alsoall the incremental backups taken between that full backup and theparticular point in time to which the system is supposed to be restored.The full backup version of the data then is processed, using the set ofincremental changes, to create a present view of the data as of thatdesignated certain point in time. This data backup model offers a highlevel of security that selected data can be restored to its presentstate, and this data backup model can be used with removable media suchas tapes and optical disks. The downside of this data backup process isdealing with a long series of incremental changes and the high storagerequirements entailed in this data backup process, since a copy of everychanged file in each incremental backup is stored in memory.

Full+Differential

A Full+Differential data backup model differs from a Full+Incrementaldata backup model in that, after the full backup is taken of all fileson the computer system, each incremental backup of the files capturesall files created or changed since the full backup, even though some mayhave been included in a previous partial backup. The advantage of thisdata backup model is that restoring the whole computer system to acertain point in time involves recovering only the last full backup andthen overlaying it with the last differential backup.

Mirror+Reverse Incremental

A Mirror+Reverse Incremental data backup model is similar to aFull+Incremental data backup model. The difference is that, instead ofan aging full data backup followed by a series of incremental databackups, this model offers a mirror that reflects the state of thecomputer system as of the last data backup and a history of reverseincremental data backups. One benefit of this data backup method is thatit only requires an initial full data backup. Each incremental databackup is immediately applied to the mirror and the files they replaceare moved to a reverse incremental backup. This data backup model is notsuited to the use of removable media, since every data backup must bedone in comparison to the data backup mirror version of the data. Thisprocess, when used to restore the whole computer system to a certainpoint in time, is also intensive in its use of memory.

Continuous Data Protection

This data backup model takes the data backup process a step further and,instead of scheduling periodic data backups, the data backup systemimmediately logs every change made on the computer system. Thisgenerally is done by saving byte or block-level differences rather thanfile-level differences. It differs from simple disk mirroring in that itenables a roll-back of the log and, thus, can restore an old image ofdata. Restoring the whole computer system to a certain point in timeusing this method requires that the original version of the data must beprocessed to incorporate every change recorded in each differentialchange to recreate the present version of the data.

Problems

In spite of all of these various methods of data backup, existing databackup systems (including both hardware and software) fail to ensurethat the user can simply plug in to the computer system to “back-up” thedata stored therein, and also enable recovery of a revision of a filefrom a point-in-time, and enable all of the hard disk(s) in the computersystem to be restored to a point-in-time. Existing data backup systemsfail to efficiently track and store the state of multiple file systemsover time, while allowing for correct disk-level and file-levelrestoration, to a point-in-time, without storing a significant amount ofredundant data. These data backup systems require the user to learn newtechnology, understand the file system of the computer system, learn howto schedule data backup sessions, and learn new controls that must beused for this new functionality. Furthermore, the restoration of lostfiles is difficult using these data backup systems.

BRIEF SUMMARY OF THE INVENTION

The above-described problems are solved and a technical advance achievedby the present System For Automatically Recovering A Computer MemoryUsing Shadowed Data And File Directory Structures (termed “DataShadowing System” herein) which comprises a memory module that isconnected to the monitored computer system via an existing communicationmedium, such as an input/output port to store the shadowed data. Thememory module includes a memory device for data storage as well assoftware, including a control software component that is automaticallyinstalled on the monitored computer system when the memory module isfirst connected to the monitored computer system, as well as associatedmodule software for maintaining a record of the data stored on thememory device and controlling the operation of the memory device.

The Data Shadowing System automatically stores the data which isretrieved from the memory of the monitored computer system onto thememory device located in the memory module in a single format, whilerepresenting it in a data management database in two formats: disksectors and files. The Data Shadowing System thereby efficiently tracksand stores the state of multiple file systems over time, while allowingfor correct disk-level and file-level restoration, to a point-in-time,without storing redundant data.

The Data Shadowing System operates autonomously, freeing the user fromneeding to interact with the Data Shadowing System to have the memory ofthe monitored computer system backed up. The backup is nearly always upto date so long as the Data Shadowing System is connected to themonitored computer system. The Data Shadowing System incorporatesdatabase technology to optimize the data storage and retrieval fornormal operations, and the database of file directory information itselfresides on the monitored computer system hard drive, while a backup copyof the database is written periodically to the Data Shadowing System.

In addition, the file changes, creations, relocations, and deletions aretracked through time, with the Data Shadowing System enablingpoint-in-time restoration of individual files as well as file systems.The full system restore capability enables the reconstruction of theentire memory of the monitored computer system, including: operatingsystem, applications, and data files for a given point in time withoutrequiring the intervention of the user.

If the Data Shadowing System memory module is disconnected from themonitored computer system for any length of time, the control softwarecomponent that executes on the monitored computer system tracks theappropriate file changes occurring through time and then performs normalbackup activities once the Data Shadowing System memory module isreconnected to the monitored computer system.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A illustrates a perspective view of a typical computer system thatis connected to the present Data Shadowing System;

FIG. 1B illustrates the basic architecture of the present Data ShadowingSystem;

FIGS. 2A and 2B illustrate, in flow diagram form, the operation of thepresent Data Shadowing System during the initial installation of theData Shadowing System on a monitored computer system;

FIG. 3 illustrates, in flowchart form, the operation of the present DataShadowing System to store a copy of the data that is presently added tothe monitored computer system's memory;

FIG. 4 illustrates, in flowchart form, the operation of the present DataShadowing System to create and store an integrity point to benchmarkchanges in the monitored computer system's memory;

FIG. 5 illustrates, in flow diagram form, the operation of the presentData Shadowing System to retrieve data stored therein for restoration ofa file in the memory of the monitored computer system; and

FIG. 6 illustrates, in flow diagram form, the operation of the presentData Shadowing System to retrieve data stored therein for restoration ofthe entirety of the memory of the monitored computer system.

DETAILED DESCRIPTION OF THE INVENTION Definitions

The following terms as used herein have the following meanings.

“File system”—the system utilized by the computer operating system toorganize, store, and access information contained in the computer systemmemory.

“File navigation system”—the textual, hierarchical navigation interfaceused by the computer operating system to provide a user with anorganized manner of storing, identifying, locating, and operating onfiles for user operations contained in the computer system memory.

“Change journal”—a computer operating system provided system to identifyand track any file changes, creations, deletions, or relocations.

“Meta file”—an indirect means of storing information about a relatedfile (e.g., file size and creation date for a data file).

“Page file”—a computer operating system defined and created file whichis specific to the present session running on the computer system; thepage file represents short-lived data that is not valid or meaningful toa subsequent session and, therefore, is of no value to retain.

“Integrity Point”—a collection of files and file references which existat a particular time to represent the files that were current and validfor that time; restoration of an integrity point ensures that files areconsistent and meaningful to the computer operating system andapplications that may require multiple files to be self-consistent.

“File Reference Number” or FRN—a unique identifier for a given file orfolder entry in the file system file table.

“NTFS”—Acronym associated with the file system for a computer operatingsystem. The file system provides an important feature known asjournaling, which creates a queue of file changes, creations, deletions,or relocations.

System Architecture

FIG. 1A illustrates a perspective view of a typical computer system thatis equipped with the present Data Shadowing System, and FIG. 1Billustrates the basic architecture of the present Data Shadowing System100. The monitored computer system 110 typically includes a processor112, memory 113 (such as a disk drive, although any form of read/writememory can be used, and the term “memory” is used herein to describethis element), and a data communication medium 115, such as aninput/output port 111, or wireless interface and the like. The DataShadowing System 100 comprises a memory module 101 that is connected tothe computer system 110 via an existing data communication medium 115,such as input/output port 111 and its associated cable to store theshadowed data. For the sake of example, the data communication mediumillustrated herein is the existing standard USB port 111, which providesboth a data communication path as well as a source of power for thememory module 101. However, any data communication medium can be used,whether wired or wireless and whether capable of supplying power to thememory module 101 or not. The memory module 101 includes a memory device102 and its associated memory module software 104 and database 105 formanaging the data storage, as well as a control software component 103that is automatically installed on the monitored computer system 110when the memory module 101 is first connected to the monitored computersystem 110.

The simplicity and ease of use of the Data Shadowing System 100 requiresminimal user interaction, and the “Autorun” feature of the USBconnection 111 can be used, for example, to support an automaticinstallation of the Data Shadowing System software component 103. Thus,upon the first connection of the memory module 101 of the Data ShadowingSystem 100 to the monitored computer system 110, the Data ShadowingSystem 100 calls the “Autorun” software resident on the operating systemof the monitored computer system 110 to initiate the installationapplication portion of the control software component 103 which isstored on the memory module 101 of the Data Shadowing System 100.(Alternatively, a mountable media can be used to initiate installationof the control software component 103 from the monitored computer system110.) The installation application then identifies that this is aninitial installation of the Data Shadowing System 100 with the monitoredcomputer system 110. The memory module software 104 requests systeminformation from the operating system of the monitored computer system110 and stores this system information in a database 105. This systeminformation subsequently is used to determine if the Data ShadowingSystem 100 has been previously connected to monitored computer system110. If the Data Shadowing System 100 has already been installed, themonitored computer system 110 activates memory module 101 and startstalking to it. Power for the memory module 101 can be obtained from thedata communication medium, or an internal or external power source canbe used, as a function of the installation of the memory module 101 andthe data communication medium 115 used.

Initialization

FIGS. 2A and 2B illustrate, in flow diagram form, the operation of thepresent Data Shadowing System 100 during the initial installation of theData Shadowing System 100 on a monitored computer system 110, where theData Shadowing System 100 is linked exclusively to this monitoredcomputer system 110 and an initial shadow copy of the contents of themonitored computer system's memory is created in the memory module 101of the Data Shadowing System 100.

The Data Shadowing System 100 in this example is powered by themonitored computer system 110 via the data communication medium 115 asnoted above, and optionally self-authenticates at step 201 when it isfirst attached to the monitored computer system 110 by ensuring that theserial number encoded into the memory device 102 of the Data ShadowingSystem memory module 101 matches the serial number entry inserted intothe control software component 103. During manufacturing, the serialnumber is queried from the memory device 102, inserted into the controlsoftware component 103, and stored onto the Data Shadowing System 100 ina manner to circumvent unauthorized replication of the Data ShadowingSystem 100 software onto additional memory devices.

The Data Shadowing System 100 then begins installation andinitialization of the Data Shadowing System 100 for the monitoredcomputer system 110 at step 202. In place of the traditional softwareinstallation process whereby the user is required to insert a mountablemedia into a selected drive of the monitored computer system 110 inorder to install software, the Data Shadowing System 100 can utilize thesimple “Autorun” feature of the USB standard of port 111. The controlsoftware component 103 of the Data Shadowing System 100 is loaded ontothe monitored computer system 110 at step 202; and at step 203, themonitored computer system 110 is interrogated by the control softwarecomponent 103 of the Data Shadowing System 100 to obtain data whichdefines the hardware topology and device signatures of the monitoredcomputer system 110. This signature information is used to “pair” theData Shadowing System 100 to the monitored computer system 110 and isstored in memory module software 104 at step 204.

The Data Shadowing System 100 displays a simple dialog box to the userat step 205 via the display screen of the monitored computer system 110to indicate that they agree to the Data Shadowing System 100 userlicense agreement. This simplified user agreement dialog is required toensure that the user is agreeable with the terms set forth in the enduser license agreement. If the user did not intend to install the DataShadowing System 100, or is dissatisfied with the end user licenseagreement, nothing remains on the monitored computer system 110pertaining to the Data Shadowing System 100.

Upon successful installation of the Data Shadowing System 100, the useris not required to take further action to ensure the protection andbackup of the data that is presently stored and subsequently added,deleted, or modified on the memory 113 of the monitored computer system110. The user is required to leave the memory module 101 of the DataShadowing System 100 attached to the monitored computer system 110 foran initial period of time in order to have an initial valid backup oftheir data files and directory structures from the monitored computersystem 110 to the memory module 101 of the Data Shadowing System 100 atstep 206, but attaching the memory module 101 of the Data ShadowingSystem 100 is the only action step required of the user. The controlsoftware component 103 concurrently monitors the ongoing memory activityof the monitored computer system 110 while the initial data backup isbeing executed without requiring the modification of the monitoredcomputer system 110 or the use of complex interconnection processes.

The Data Shadowing System 100 efficiently stores the data retrieved fromthe memory 113 of the monitored computer system 110 in a single format,while representing it internally in two formats: disk sectors and files.The Data Shadowing System 100 also efficiently tracks and stores thestate of multiple file systems that are resident on the monitoredcomputer system 110 over time, while allowing for correct disk-level andfile-level restoration, to a point-in-time, without storing redundantdata. A Meta File System may be implemented in the Data Shadowing System100 to describe the state of each active file system and the underlyingphysical disk or disks, at a point-in-time, with integrity. The MetaFile System is an internally consistent, related-in-time, collection ofcritical data and metadata from the file systems and physical disksunder its protection. The Meta File System may collect certain data, anddo so in a way that correctness is ensured.

Typical Meta-File data that is collected may include:

-   -   A baseline image of the non-NTFS sectors which are formatted on        each physical disk installed in the monitored computer system        110.    -   A complete indexing of the file systems contained on each        physical disk for a designated point-in-time. This index        includes the mapping of file objects to their location on the        physical disk.    -   A serialized journal of file system changes over time.    -   Copies of the file object contents resulting from file system        changes over time.    -   Multiple self-consistent “snapshots” of the on-disk metadata for        each active file system at a point-in-time.

The challenge of creating a consistent-in-time view of multiple activefile systems is met by combining the collected data into a singledatabase and organizing and accessing it via data management algorithmsresident in the Data Shadowing System 100.

Memory Indexing

The first step in this initial data transfer process is to generate amaster index of all contents of the monitored computer system's memory113 at step 206. The control software component 103 discovers eachstorage device (memory 113) on the monitored computer system 110 andcreates a corresponding Object Model for each Storage Device(TRStorageDevice). The Storage Device objects are children of themonitored computer system 110. While they all share some base levelattributes, they can specialize for different aspects of the physicaldevice.

For each TRStorageDevice, monitored computer system 110 identifies allof the unique disk regions that it contains and creates an object modelfor each (TRDiskRegion). While all TRDiskRegions share some basictraits, they specialize themselves according to the type of Region theydescribe. For instance, examples of unique disk regions include theMaster Boot Record (MBR), the partition table, a file system region(NTFS or FAT32 partition), a hidden OEM recovery partition, andseemingly unused “slices” that are the leftovers between formalpartitions. Data Shadowing System 100 identifies and accounts for everysingle sector on a physical storage device and creates an appropriateTRDiskRegion object to manage and index them.

TRDiskRegions that do not have a recognizable file system are treated as“Block Regions.” Block Regions comprise a span of disk sectors (start,from sector zero, and length), and are simply archived as a block rangeonto the Data Shadowing System 100 memory device 102.

This master index includes processing the master boot record and filesystem at step 207 to generate an index of every partition, file, andfolder on the monitored computer system 110; and this index data foreach partition, file, and folder is entered into a database 114 residingon the monitored computer system memory 113 as well as optionally adatabase 105 in the memory module 101.

The master boot record contains information about the arrangement ofdata on the monitored computer system memory 113. These contents may bearranged with subsets of data such that there is a primary bootablepartition and alternate, non-bootable partitions. An entry in the masterboot record determines the status of these partitions, as well as sizeand binary offset values for each partition. Capturing and processingthis information permits the Data Shadowing System 100 to automaticallyreconstruct the entire contents of the monitored computer system memory113. The database exists largely to facilitate a (faster) way to searchand retrieve file history and revisioning. The method used to lay downthe “copy/backup” of the file system of the monitored computer system110 enables recreation of the data contained in the database 114 fromthe Data Shadowing System 100 itself. In the case of Data ShadowingSystem 100, most of the Object Models that model a feature or attributeof the monitored computer system 110 are persisted to the Data ShadowingSystem 100 memory module 101 as file system streams in a directorystructure that matches or emulates the physical hierarchy from wherethey came from.

After processing the master boot record, the file system for the primarybootable partition is processed at step 208 to record each file andfolder entry, placing records into the database 114 residing on themonitored computer system memory 113. This database contains informationabout each file and folder and is accessed primarily during fileretrieval requests and is also updated with changes to individual filesand folders to create a chronological record of changes. This samedatabase 114 is mirrored (database 105) onto the Data Shadowing Systemmemory module 101 whenever the memory module 101 is connected to themonitored computer system 110. The mirrored database 105 is usedprimarily during full-system restoration where the monitored computersystem memory 113 may have failed and the mirrored database 105 containsrecords of each file and folder residing in the binary data copied tothe Data Shadowing System memory device 102. TRDiskRegions that do havea recognized file system create an Object Model for the file system“Volume” (TRVolume). A Volume understands the concepts and navigation ofits contained file system and the concept of its associated mount point.

Memory Copy

Upon completion of processing the master boot record and file system,the Data Shadowing System 100 begins the second step of this process bycopying the binary information from the monitored computer system memory113 with the exception of a subset of the memory 113. The exceptionsubset consists of: areas not allocated, or identified as in use, by anyof the partitions, as well as areas identified as temporary informationby the operating system. An example of the temporary information is theoperating system page file, which is useful only during the currentsession and is meaningless to a subsequent session.

The copy process identifies a Data Shadowing System 100 storage deviceand writes the non-NTFS file objects onto the Data Shadowing System 100memory device 102 at step 211. Once all of these objects are writteninto memory device 102, the Data Shadowing System 100 writes all of theNTFS files onto memory device 102 at step 212 in a directory hierarchythat mimics their physical and logical relationships on the monitoredcomputer system 110. Below is a simple base directory tree of a DataShadowing System 100 (depth of the contained file systems has beenomitted:

-   -   R:\data\REBITDV05\072CE3A9    -   R:\data\REBITDV05\19F418B5    -   R:\data\REBITDV05\647931C9    -   R:\data\REBITDV05\647931D6    -   R:\data\REBITDV05\072CE3A9\Region0    -   R:\data\REBITDV05\072CE3A9\Region1    -   R:\data\REBITDV05\072CE3A9\Region2    -   R:\data\REBITDV05\072CE3A9\Region1\{ddffc3ed-7035-11dc-9485-000c29fddfb0}    -   R:\data\REBITDV05\072CE3A9\Region2\{ddffc3f3-7035-\11dc-9485-000c29fddfb0}    -   R:\data\REBITDV05\19F418B5\Region0    -   R:\data\REBITDV05\19F418B5\Region1    -   R:\data\REBITDV05\19F418B5\Region1\{732534f9-cb5a-11db-befe-806e6f6e6963}    -   R:\data\REBITDV05\647931C9\Region0    -   R:\data\REBITDV05\647931C9\Region1    -   R:\data\REBITDV05\647931C9\Region1\{a93586cc-cb5f-11db-b097-000c29e897d0}    -   R:\data\REBITDV05\647931D6\Region0    -   R:\data\REBITDV05\647931D6\Region1    -   R:\data\REBITDV05\647931D6\Region2    -   R:\data\REBITDV05\647931D6\Region1\{a93586d2-cb5f-11db-b097-000c29e897d0}

The control software component 103 knows that the Networked DataShadowing System storage device 103 was mounted on drive “R:” and allarchiving operations are going to directory “data” which is located inthe memory module 101. The next indicia in this string is the name ofthe monitored computer system 110 that provided the content“REBITDEV05”, then the physical disk signature (i.e. 072CE3A9, 072CE3A9,etc.). If the disk drive has data that is to be archived, it is thenorganized into Region objects that are simply sequentially numbered(Region0, Region1, etc.). If a region contains an understood filesystem/volume, its volume identifier is used in the persistent storageto map its path. In the case ofR:\data\REBITDV05\072CE3A9\Region1\{ddffc3ed-7035-11dc-9485-000c29fddfb0},on this system, it happens that this is an NTFS volume, and a fullmirror of the file system for drive “C:” of the monitored computersystem 110.

A key point here is that the Object Models for each element of themonitored computer system 110 are themselves stored in file systemstreams on the Data Shadowing System 100 memory device 102. For example,the TRMachine object is “saved” as a hidden stream inside of theR:\data\REBITDEV05\ directory entry, and the volume object forR:\data\REBITDV05\072CE3A9\Region1\{ddffc3ed-7035-11dc-9485-000c29fddfb0}is saved as a hidden stream on that directory entry.

What this means is, from the Data Shadowing System 100 file systemalone, all of the object relationships and their metadata can bereconstructed with no database. Further, when a file eventually isarchived to the Data Shadowing System 100, all of its associated historyand metadata are stored as hidden streams in the file entry itself. Thedatabase 114 can be completely reconstructed from the Data ShadowingSystem 100 storage file system itself.

In addition, in the Data Shadowing System 100 storage architecture, thefiles are not actually stored with the name they had on the monitoredcomputer system 110. Rather, they are stored with a file name that is aunique hash value of the contents of that file. A file system “softlink” then is used in the directory structure above to point to the dataof the hash value named “blob” of data that is the file from themonitored computer system 110. The user only sees the soft link. DataShadowing System 100 stores the hashed value named file. If any twofiles hash to the same value (meaning they are binary identical), onlyone copy need be hosted in storage, and the symbolic links for both hostcopies point to the same stored content. This attribute of functionalityis the first level of intrinsic data de-duplication.

To continue, when a file is modified on the monitored computer system110, the new data is hashed, named, and stored on the monitored computersystem 110; and the old version of the file is removed and replaced withonly a description of its binary differences to the new version (ReverseX-Delta). This strategy allows for Data Shadowing System 100 to keeppristine copies of all current files, while being able to regenerateprevious versions at all times and minimizing data storage spacerequirements on the Data Shadowing System 100 itself.

Because of the time required to read the memory 113 of the monitoredcomputer system 110, and because it contains an active file system, theData Shadowing System 100 enables Journaling at step 209 for the activefile systems residing on the physical disk being imaged. In addition,the Data Shadowing System 100 at step 210 sets the flag in the databaseindicating an Integrity Point is desired by creating a set of cursorsagainst the active file system journals, which set of cursors are termedthe “Start Cursors”. The Journal process begins identifying and queuingfiles to act upon. Once the cursors are created, the Data ShadowingSystem 100 at step 211 creates and compresses an image of the activefile systems into the memory device 101 of the memory module 101 of theData Shadowing System 100. To save memory space, the active file systemsare queried for their allocated regions of the physical disk, and onlyallocated regions are read and compressed.

At step 212, the Data Shadowing System 100 indexes the active filesystems to extract relevant metadata for every file object in the filesystem and records it in a database. The Data Shadowing System 100identifies and indexes all directories contained within the filenavigation system by File Reference Number, or FRN, and identifies andinserts entries into the database for each cluster run representing thefile. The Data Shadowing System 100 initializes the baseline byinserting entries in the database signifying completion of theinitialization. Once the image and index are complete, the DataShadowing System 100 at step 213 creates a second set of cursors againstthe active file system journals, termed the “Most Recent Entries”.

At step 214, the Data Shadowing System 100 enables Change Tracking; andat step 215, the journals for the active file systems are processed fromthe Start Cursor to the Most Recent Entry, to record records of changesin the database, including file object contents. Upon reaching apoint-in-time where no files remain in the queue to process, theappropriate actions are taken to insert an Integrity Point entry intothe database.

Finally, at step 216, the Data Shadowing System 100 records an IntegrityPoint in the database to which the baseline image and file object changerecords are related. This is the data required to allow aself-consistent Disk Recovery at the point-in-time which the IntegrityPoint represents. Thus, the full disk copy and the file changes,creations, deletions, or relocations that occurred during the full diskcopy are collected into a set to represent a fully restorable pointcalled the “Integrity Point”.

Change Tracking

FIG. 3 illustrates, in flowchart form, the operation of the present DataShadowing System 100 to store a copy of data that are newly added to themonitored computer system's memory 113. The Data Shadowing System 100process registers with the operating system change journal in order toreceive notification of changes occurring to files and folders residingon the monitored computer system memory 113. The change journal thendynamically notifies the Data Shadowing System 100 of changes,permitting the Data Shadowing System 100 to determine the appropriateaction to take. File creation, movement, content changes, and renamingare all events requiring action, and each action is entered into anaction queue for processing.

The Data Shadowing System action queue is utilized for periods where theData Shadowing System memory module 101 is attached or detached from themonitored computer system 110. If the memory module 101 is attached tothe monitored computer system 110, the Data Shadowing System 100processes each action queue entry, updating the entry in the database114 and, if necessary, compressing and transferring the file binarycontents to the Data Shadowing System memory module 101.

During periods of time that the Data Shadowing System memory module 101is detached, the action queue is utilized for recording actions that areto be performed once the memory module 101 is attached to the monitoredcomputer system 110. This recording process permits the Data ShadowingSystem 100 to prioritize the actions to be performed, selecting thefiles of highest importance to be processed before lower priority files.This is the continuous process of maintaining the data required toassemble a consistent-in-time view of the file systems. The process ofchange tracking begins immediately after the Initialization and Indexingis complete, as described above.

Journal Processing

Journal processing is continuous and occurs whether or not the DataShadowing System memory module 101 is attached to the monitored computersystem 110. The control software component 103 of the Data ShadowingSystem 100 at step 301 queries the file system journals for any morerecent changes, starting from the last entry previously processed. Thecontrol software component 103 at step 302 then creates a change recordin the action queue in database 114 and increments the journal cursorfor each relevant journal entry. For each relevant journal entry, thecontrol software component 103 creates a change record in the actionqueue in database 114 and increments the journal cursor. When thejournal entries are exhausted (up-to-date), the control softwarecomponent 103 watches for new entries.

Data Synchronization

Data Synchronization is intermittent and occurs only when the DataShadowing System memory module 101 is attached to the monitored computersystem 110. When the memory module 101 is attached to the monitoredcomputer system 110, the control software component 103 startsprocessing at step 304 from the first unprocessed change record in theaction queue in database 114. For the oldest change record, and allrelated, unprocessed change records, the control software component 103at step 305 determines if each is still relevant (for example, if thefile was created and is already deleted, it is not relevant). Thecontrol software component 103 at step 306 removes all non-relevantchange records from the action queue in database 114. Alternatively, atstep 307, the control software component 103 takes the appropriateaction for each relevant change record. If the file was created, thecontrol software component 103 stores new file and file-version recordsin the action queue in database 114 and copies the file-version'scontents to the Data Shadowing System memory module 101 at step 308. Ifthe file was moved or renamed, the control software component 103creates a new file record in the action queue in database 114, relatesall file-versions from the old file record with the new file record, andmarks the old file record as deleted at step 309. If the file wasdeleted, the control software component 103 marks the file record in theaction queue in database 114 as deleted at step 310. If a directory wascreated, the control software component 103 stores a new directoryrecord in the action queue in database 114. If a directory was moved orrenamed, the control software component 103 creates a new directoryrecord in the action queue in database 114, relates all file recordsfrom the old directory record with the new directory record, and marksthe old directory record as deleted at step 312. If a directory wasdeleted, the control software component 103 marks the directory recordin the action queue in database 114 as deleted at step 313. Finally, atstep 314, the control software component 103 removes the change recordfrom the action queue in database 114 and processing returns to step305.

Create an Integrity Point

FIG. 4 illustrates, in flowchart form, the operation of the present DataShadowing System 100 to create and store an Integrity Point to benchmarkchanges in the monitored computer system's memory 113.

This is the operation required to store the information necessary toexecute a Disk Recovery for a point-in-time. The process of creating anIntegrity Point requires reading and storing a self-consistent“snapshot” of the metadata files maintained on-disk by the active filesystems. This requires monitoring these file systems for changesoccurring while the snapshot is created and deciding if they invalidatethe snapshot, requiring another attempt. Exemplary operations includethe following steps.

Before attempting to create an Integrity Point, Journal Processing andData Synchronization must be up-to-date. Each active file system isqueried (or directly parsed) by the control software component 103 atstep 401 to determine the physical locations on-disk that is hasallocated for its own use (File System Regions). These File SystemRegions contain the data structures that define a consistent state ofthe file system and must be self-consistent. The control softwarecomponent 103 then queries each active file system's journal at step 402for its next record index, and this value is kept as a cursor. Thecontrol software component 103 instructs the operating system to flushall active file systems to memory 102 at step 403, and the File SystemRegions for each active file system are read directly from disk 113 atthe sector level and stored in an archive on the Data Shadowing System100 at step 404.

The control software component 103 again queries each active filesystem's journal at step 405 for its next record index, and this valueis compared with the previously recorded cursor. If the cursors match,then at step 406, the Integrity Point is “confirmed” and marked as suchin the database 114. If the cursors do not match, the offending journalis queried for the inter-cursor entries at step 407. The entries areexamined by the control software component 103 at step 408, and adecision is made whether or not they invalidate the snapshot. If so, theprocess is repeated from step 401 until a valid snapshot is achieved. Ifthe snapshot is valid, then at step 410, all file objects that resultedfrom change records occurring between the previous Integrity Point andthis one are related to this Integrity Point record in the database 114and the Integrity Point is marked as “sealed.” The database applicationis instructed at step 411 to perform a backup operation, resulting inthe placement of a compressed representation of the database 114 ontothe memory module 101 of the Data Shadowing System 100.

File Version Retrieval

FIG. 5 illustrates, in flow diagram form, the operation of the presentData Shadowing System 100 to retrieve data stored therein forrestoration of a file in the memory 113 of the monitored computer system110. This is the operation to “reconstitute” the contents of a file at apoint-in-time. This file-version may reside in the baseline disk imagestored to the Data Shadowing System 100 during initialization or in afile-version archive on the Data Shadowing System 100.

The database 114 contains records of each file that has been stored onthe Data Shadowing System 100, including the files captured duringinitialization. Over the course of time, data which enables therestoration of multiple versions of a given file may be stored on theData Shadowing System 100, creating the ability to retrieve a version ofa file from one of several points-in-time. When a file is modified onthe monitored computer system 110, the new data is hashed, named, andstored on the monitored computer system 110; and the old version of thefile is removed and replaced with only a description of its binarydifferences to the new version (Reverse X-Delta). This strategy allowsfor Data Shadowing System 100 to keep pristine copies of all currentfiles, while being able to regenerate previous versions at all times andminimizing data storage space requirements on the Data Shadowing System100 itself.

The process of retrieving a file from the database and related locationof the Data Shadowing System 100 begins at step 501 where the user opensa user interface and navigates through the hierarchical file and foldersystem to locate the desired file or folder. The user selects thedesired file or folder at step 502 and uses “drag and drop”functionality to move the selected file or folder to another folderlocation (e.g., ‘Desktop’ or ‘My Documents’) on the monitored computersystem. Upon releasing the mouse button, the operating system at step503 generates a request from the Data Shadowing System 100 for datarelated to the source file identified by the user interface. Thedatabase then is queried at step 504 to locate the present version ofthe selected file and its binary differences to the new version, tracedback to the point-in-time selected by the user.

If the user selects a present version of the file, at step 505, the DataShadowing System 100 retrieves the pristine copy of the current file anddelivers the file to the user. Otherwise, the Data Shadowing System 100,at step 506, uses the collection of binary differences to trace theselected file backwards in time to recreate the selected version of thefile as indicated by the user, and then delivers the reconstructed fileto the user. The user reads and seeks on the data stream interface atstep 507 and processes the contents as desired.

Disk Recovery

FIG. 6 illustrates, in flow diagram form, the operation of the presentData Shadowing System 100 to retrieve data stored therein forrestoration of the entirety of the memory 113 of the monitored computersystem 110. This is the operation required to restore the complete stateof a physical disk 113 of the monitored computer system 110 at apoint-in-time. The available points-in-time are defined by previouslystored Integrity Points. The goal of a Disk Recovery is to“reconstitute” a self-consistent image of the subject physical disk 113to the sector level and write this to a hard disk 113 on the monitoredcomputer system 110.

In order to write to the physical system disk 113, it is necessary toboot the monitored computer system 110 from an alternative media andensure that the file systems on that disk 113 are not in use at step601. At step 602, the user must ensure that the environment isacceptable. The Data Shadowing System 100 is connected to the monitoredcomputer system 110 at step 603 and must be accessible. At step 604, thesubject hard disk(s) 113 must be available and large enough to receivethe restoration disk image. The subject hard disk 113 does not need tobe formatted, but can be formatted if desired. At step 605, any filesystems present on the subject hard disk(s) are unmounted and the userselects an Integrity Point to restore onto the subject hard disk(s) 113at step 606.

The baseline non-NTFS disk image(s) stored on the Data Shadowing System100 is written directly to the subject hard disk(s) 113 sector-by-sectorat step 607. The database 114 is queried at step 608 for the snapshotcorresponding to the closest file system image to the selected baseline.At step 609, the snapshot is written to the subject hard disk(s) and,for each file object, the database 114 is queried at step 610 for thefile object's storage location. The file object's contents are writtendirectly to its disk location at step 611. The subject drive(s) 113 arenow ready for use, and the monitored computer system 110 may be rebootedat step 612.

Guest PC/Portable File Access

The Data Shadowing System 100 makes note of distinguishing features ofthe monitored computer system 110 such that the connection of the DataShadowing System memory module 101 to a second, non-host computer systemis quickly identified. In this alternative connection condition, theData Shadowing System “Autorun” initialization application asks the userif they want access to the files stored within the Data Shadowing Systemmemory module 101 or if they wish to re-initialize the Data ShadowingSystem 100 to pair with the newly connected computer system. If the userwishes to re-initialize with the newly connected computer system, allbackup data from the previous monitored computer system 110 iseliminated, and a message indicating the same is displayed. If the userwishes to access files contained on the memory module 101, the DataShadowing System 100 initializes a limited application permitting theuser to utilize the same graphical user interface as before. The usermay then locate and drag-and-drop files onto the newly connectedcomputer system hard disk drive.

The operating system on the monitored computer system recognizesspecific files contained in the base directory of a disk drive or DataShadowing System 100 newly connected to the monitored computer system110. The file of type ‘autorun.inf’ alerts the operating system to thepresence of a sequence of operations to be performed, as defined withinthe file. The Data Shadowing System 100, upon successful installationonto the monitored computer system 110, alters this ‘autorun.inf’ fileto behave differently if plugged into a subsequent, or guest, computersystem. This altered ‘autorun.inf’ file instructs the Data ShadowingSystem 100 to make available the contents of the drive by reconstructingand interrogating the duplicated database. Through this method, userfiles of interest may be identified for copying onto the guest computersystem. Therefore, the monitored computer system's files, such asdigital photographs and music files, may be transferred from the DataShadowing System 100 onto the guest computer system for display orsharing as desired.

In order to make the access to files on the guest computer system asseamless as the access on the monitored computer system, the fileexplorer system of the guest computer system is utilized. By registeringwith, and making calls to, the file explorer system, the display of thecontents of the Data Shadowing System 100 mimics the display of thecontents of the user's typical computer system.

Summary

The Data Shadowing System automatically stores the data on the memorymodule in a single format, while representing it in a data managementdatabase in two formats: disk sectors and files. The Data ShadowingSystem thereby efficiently tracks and stores the state of multiple filesystems over time, while allowing for correct disk-level and file-levelrestoration to a point-in-time without storing redundant data.

What is claimed as new and desired to be protected by Letters Patent ofthe United States is:
 1. A data shadowing system, connected to amonitored computer system, for the automatic backup storage of data intothe data shadowing system that is written in the memory of the monitoredcomputer system and the selective retrieval of this data from the datashadowing system for restoration to said memory of said monitoredcomputer system, said data shadowing system comprising: data shadow copymodule, connected to a monitored computer system, for storing a shadowcopy of the data which is written in the memory of the monitoredcomputer system; customer data file manager, resident in said monitoredcomputer system, for autonomously transmitting customer data filesresident on said monitored computer system, to said data shadow copymodule, comprising: customer data file map generator for autonomouslymapping file directory structures associated with each of customer datafiles written in the memory of the monitored computer system into filetree information which comprises: original names of each customer datafile as stored on said monitored computer system, a physical location ofeach customer data file as stored on said monitored computer system, anda corresponding physical location in said data shadow copy module whichstores a copy of these customer data files to enable both memory-leveland file-level restoration of customer data files on the memory of themonitored computer system to restore the physical disk image of thememory of the monitored computer system, change journal forautomatically tracking changes to said customer data files, including:customer data file creation, customer data file movement, customer datafile content changes, and customer data file renaming, file history,responsive to a modification of a customer data file, for generating aset of file change data indicative of a difference between said customerdata file and said modified customer data file, and mapping database forstoring said file tree information in said data shadow copy module;wherein said data shadow copy module comprises: customer data filestorage for storing each of said customer data files in said data shadowcopy module and, for modified customer data files, for storing said setof file change data and substituting said modified customer data filefor said customer data file in said memory module; and customer datafile restoration process, responsive to a user requesting restoration ofat least one customer data file, for retrieving said file treeinformation and autonomously writing said requested customer data fileto said physical memory location of said monitored computer system wheresaid customer data file was originally stored on said monitored computersystem.
 2. The data shadowing system of claim 1 wherein said customerdata file restoration process comprises: customer data file point intime manager, responsive to said user identifying a previous version ofsaid at least one customer data file, for revising said at least onecustomer data file with each set of said stored file change dataassociated with said at least one customer data file which has beenstored in said data shadow copy module retrospectively to said previousversion.
 3. The data shadowing system of claim 2 wherein said customerdata file restoration process further comprises: restored customer datafile writer, responsive to said at least one customer data file beingrevised by said customer data file point-in-time, for writing saidrequested customer data file to said memory of said monitored computersystem.
 4. The data shadowing system of claim 1, further comprising:system file manager for automatically mapping system files written inthe memory of the monitored computer system into file tree informationwhich comprises: original names of system files as stored on saidmonitored computer system, a location of each system file as stored onsaid monitored computer system, and a location in said data shadow copymodule which stores said system files; system file storage for storingeach of said system files in said data shadow copy module; and systemfile restoration, responsive to a user requesting restoration of atleast one system file, for retrieving said file tree information andautonomously writing said requested system file to said memory locationof said monitored computer system where said system file was originallystored on said monitored computer system.
 5. A data shadowing system,connected to a monitored computer system, for the automatic backupstorage of data into the data shadowing system that is written in thememory of the monitored computer system and the selective retrieval ofthis data from the data shadowing system for restoration to said memoryof said monitored computer system, said data shadowing systemcomprising: data shadow copy module, connected to a monitored computersystem, for storing a shadow copy of the data which is written in thememory of the monitored computer system; data manager, resident in saidmonitored computer system, for autonomously transmitting customer datafiles resident on said monitored computer system, to data shadow copymodule, comprising: customer data file map generator for autonomouslymapping file directory structures associated with each of customer datafiles written in the memory of the monitored computer system into filetree information which comprises: original names of each customer datafile as stored on said monitored computer system, a physical location ofeach customer data file as stored on said monitored computer system, anda corresponding physical location in said data shadow copy module whichstores a copy of these customer data files to enable both memory-leveland file-level restoration of customer data files on the memory of themonitored computer system to restore the physical disk image of thememory of the monitored computer system, change journal forautomatically tracking changes to said customer data files, including:customer data file creation, customer data file movement, customer datafile content changes, and customer data file renaming, file history,responsive to a modification of a customer data file, for generating aset of file change data indicative of a difference between said customerdata file and said modified customer data file, system file manager forautomatically mapping system files written in the memory of themonitored computer system into file tree information which identifiesoriginal names of system files as stored on said monitored computersystem, and a location in said data shadow copy module which stores saidsystem files, mapping database for storing said file tree information insaid data shadow copy module; wherein said data shadow copy modulecomprises: system file storage for storing each of said system files insaid data shadow copy module, customer data file storage for storingeach of said customer data files in said data shadow copy module and,for modified customer data files, for storing said set of file changedata and substituting said modified customer data file for said customerdata file in said data shadow copy module; and monitored computer systemmemory restoration process, responsive to a user requesting restorationof the entirety of said memory of said monitored computer system, forretrieving said file tree information and autonomously reconstructingthe entire contents of the monitored computer system physical memorywhere said customer data file was originally stored on said monitoredcomputer system.
 6. The data shadowing system of claim 5, furthercomprising: integrity point manager for generating a snapshot of saidmemory of said monitored computer system comprising data correspondingto the file system image of said memory at a selected point-in-time. 7.The data shadowing system of claim 6 wherein said monitored computersystem memory restoration process comprises: snapshot retrieval forretrieving from said database said data corresponding to the file systemimage of said memory at a selected point-in-time indicated by said user;and file restoration process for writing said system files and saidcustomer data files identified in said snapshot to said memory of saidmonitored computer system.
 8. The data shadowing system of claim 6wherein said monitored computer system memory restoration processcomprises: snapshot retrieval for retrieving from said database saiddata corresponding to the file system image of said memory at a selectedpoint-in-time indicated by said user; system file restoration processfor writing said system files, whose location is identified in saiddatabase, from said identified location memory in said data shadow copymodule directly to said memory of said monitored computer systemsector-by-sector; and customer data file restoration process for writingeach customer data file, whose location is identified in said database,from said identified location memory in said data shadow copy module tosaid memory of said monitored computer system.
 9. A method for theautonomous restoration of data, which was backed up from the memory of amonitored computer system, into a data shadowing system which isconnected to the monitored computer system, to said memory of themonitored computer system, comprising: storing in a data shadow copymodule, which is connected to a monitored computer system, a shadow copyof the data which is written in the memory of the monitored computersystem; autonomously storing customer data files, resident in saidmonitored computer system, on said data shadow copy module, comprising:autonomously mapping file directory structures associated with each ofthe customer data files written in the memory of the monitored computersystem into file tree information which comprises: original names ofeach customer data file as stored on said monitored computer system, aphysical location of each customer data file as stored on said monitoredcomputer system, and a corresponding physical location in said datashadow copy module which stores a copy of these customer data files toenable both memory-level and file-level restoration of customer datafiles on the memory of the monitored computer system to restore thephysical disk image of the memory of the monitored computer system,automatically tracking changes to said customer data files, including:customer data file creation, customer data file movement, customer datafile content changes, and customer data file renaming, generating, inresponse to a modification of a customer data file, a set of file changedata indicative of a difference between said customer data file and saidmodified customer data file, and storing said file tree information insaid data shadow copy module; wherein said step of storing in said datashadow copy module comprises: storing each of said customer data filesin said data shadow copy module and, for modified customer data files,for storing said set of file change data and substituting said modifiedcustomer data file for said customer data file in said data shadow copymodule, retrieving, in response to a user requesting restoration of atleast one customer data file, said file tree information, andautonomously writing said requested customer data file to said physicalmemory location of said monitored computer system where said customerdata file was originally stored on said monitored computer system. 10.The method for the autonomous restoration of data of claim 9 whereinsaid step of autonomously writing comprises: revising, in response tosaid user identifying a previous version of said at least one customerdata file, said at least one customer data file with each set of saidstored file change data associated with said at least one customer datafile which has been stored in said data shadow copy moduleretrospectively to said previous version.
 11. The method for theautonomous restoration of data of claim 10 wherein said step ofautonomously writing further comprises: writing, in response to said atleast one customer data file being revised by said customer data filepoint-in-time means, said requested customer data file to said memory ofsaid monitored computer system.
 12. The method for the autonomousrestoration of data of claim 9, further comprising: automaticallymapping system files written in the memory of the monitored computersystem into file tree information which comprises: original names ofsystem files as stored on said monitored computer system, a location ofsystem files as stored on said monitored computer system, and a locationin said data shadow copy module which stores said system files; storingeach of said system files in said data shadow copy module; andautonomously writing, in response to a user requesting restoration of atleast one system file, said requested system file to said memorylocation of said monitored computer system where said system file wasoriginally stored on said monitored computer system.
 13. A method forthe autonomous restoration of data, which was backed up from the memoryof a monitored computer system, into a data shadowing system which isconnected to a monitored computer system, to said memory of themonitored computer system, comprising: storing in a data shadow copymodule, which is connected to a monitored computer system, a shadow copyof the data which is written in the memory of the monitored computersystem; autonomously storing customer data files, resident in saidmonitored computer system, on said data shadow copy module, comprising:autonomously mapping file directory structures associated with each ofthe customer data files written in the memory of the monitored computersystem into file tree information which comprises: original names ofeach customer data file as stored on said monitored computer system, aphysical location of each customer data file as stored on said monitoredcomputer system, and a corresponding physical location in said datashadow copy module which stores a copy of these said customer data filesto enable both memory-level and file-level restoration of customer datafiles on the memory of the monitored computer system to restore thephysical disk image of the memory of the monitored computer system,automatically tracking changes to said customer data files, including:customer data file creation, customer data file movement, customer datafile content changes, and customer data file renaming, generating, inresponse to a modification of a customer data file, a set of file changedata indicative of a difference between said customer data file and saidmodified customer data file, automatically mapping system files writtenin the memory of the monitored computer system into file treeinformation which identifies original names of system files as stored onsaid monitored computer system, and a location in said data shadow copymodule which stores said system files; and storing said file treeinformation in said data shadow copy module; wherein said step ofstoring in said data shadow copy module comprises: storing each of saidsystem files in said data shadow copy module, storing each of saidcustomer data files in said data shadow copy module and, for modifiedcustomer data files, for storing said set of file change data andsubstituting said modified customer data file for said customer datafile in said data shadow copy module; and retrieving, in response to auser requesting restoration of the entirety of said memory of saidmonitored computer system, said file tree information, and autonomouslyreconstructing the entire contents of the monitored computer systemmemory to said physical memory locations of said monitored computersystem where said customer data files were originally stored on saidmonitored computer system.
 14. The method for the autonomous restorationof data of claim 13, further comprising: generating a snapshot of saidmemory of said monitored computer system comprising data correspondingto the file system image of said memory at a selected point-in-time. 15.The method for the autonomous restoration of data of claim 14 whereinsaid step of autonomously reconstructing comprises: retrieving from saiddatabase said data corresponding to the file system image of said memoryat a selected point in time indicated by said user; and writing saidsystem files and said customer data files identified in said snapshot tosaid memory of said monitored computer system.
 16. The method for theautonomous restoration of data of claim 15 wherein said step ofautonomously reconstructing comprises: retrieving from said databasesaid data corresponding to the file system image of said memory at aselected point-in-time indicated by said user; writing said systemfiles, whose location is identified in said database, from saididentified location memory in said data shadow copy module directly tosaid memory of said monitored computer system sector-by-sector; andwriting each customer data file, whose location is identified in saiddatabase, from said identified location memory in said data shadow copymodule to said memory of said monitored computer system.